About MuS

MuS · ‎02-18-2018

Hi ash2l, If you download and install Splunk, you get the Enterprise Trail license http://docs.splunk.com/Documentation/Splunk/latest/Admin/TypesofSplunklicenses#Compare_license_features which is a fully featured license valid for 60 days http://docs.splunk.com/Documentation/Splunk/latest/Admin/TypesofSplunklicenses#Enterprise_trial_license You might got confused with the free license http://docs.splunk.com/Documentation/Splunk/latest/Admin/TypesofSplunklicenses#Free_license which has the following features disabled: Multiple user accounts and role-based access controls Distributed search Forwarding in TCP/HTTP formats (you can forward data to other Splunk software instances, but not to non-Splunk software instances) Deployment management (including for clients) Alerting/monitoring Authentication and user management, including native authentication, LDAP, and scripted authentication. There is no login. The command line or browser can access and control all aspects of Splunk software with no user/password prompt. You cannot add more roles or create user accounts. Searches are run against all public indexes, 'index=*' and restrictions on search such as user quotas, maximum per-search time ranges, search filters are not supported. The capability system is disabled, all capabilities are enabled for all users accessing Splunk software. Hope that helps and good luck with the exam ... cheers, MuS

MuS · ‎02-15-2018

@auaave, let's take that offline - I will contact you. cheers, MuS

MuS · ‎02-14-2018

okay give this a try: index="main" ( source="FC_READ" OR source="FC_NOREAD" ) ( source="DEST_MSG" LOCATION=0001 ) | eval LOCATION=case(like(LOCATIONTEXT,"%RS%"),"RS", like(LOCATIONTEXT,"%Induct%") or like(LOCATIONTEXT,"%Receiving%"),"Conveyors") | stats count(eval(source="FC_READ" OR (BIT=0001 OR BIT=0004 OR BIT=0009))) AS READ, count(eval(source="FC_NOREAD" OR BIT=0002)) AS NOREAD by LOCATION | eval "READ%"=round(READ/(READ+NOREAD)*100,2), LOCATION=if(LOCATION="0001", "SORTER", LOCATION)

MuS · ‎02-14-2018

Makeresults simply creates an event for you, nothing more. Okay baby steps first: Does the second search search source="DEST_MSG" LOCATION=0001 | stats count(eval(BIT=0001 OR BIT=0004 OR BIT=0009)) AS READ count(eval(BIT=0002 )) AS "NOREAD" by LOCATION return anything?

MuS · ‎02-14-2018

why is there a makeresults in the second query | append [**|makeresults** |search source="DEST_MSG" LOCATION=0001 | stats count(eval(BIT=0001 OR BIT=0004 OR BIT=0009)) AS READ count(eval(BIT=0002 )) AS "NOREAD" by LOCATION | eval "READ%"=round(((READ*100)/(READ+NOREAD)),2) | replace "0001" with SORTER]

MuS · ‎02-14-2018

you are not using the command I posted and most likely you are doing it not as the splunk user. Switch user to the Splunk user account (in most cases splunk ) and run the correct command as posted 😉

MuS · ‎02-14-2018

Hi shawno, you can use the following Splunk CLI command: $SPLUNK_HOME/bin/splunk btool indexes list --debug This will show you the config file path so you will know where to change the settings. And yes, you should use your own file in either $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/apps/<yourappnamehere>/local . Never change any setting in any file in $SPLUNK_HOME/etc/system/default . Hope this helps ... cheers, MuS

MuS · ‎02-13-2018

This file is used on all Splunk instances, even universal forwarders, and is found in $SPLUNK_HOME/etc on *nix or $SPLUNK_HOME/etc on *win cheers, MuS

MuS · ‎02-08-2018

Hi Criviere, If this log has a timestamp in it, you could write a modular input that polls every x minutes for data. Then you use the last timestamp out of the logs in a checkpoint file. On the next run you query the checkpoint time and only get events that are newer. I have done this before and works like a charm. cheers, MuS

MuS · ‎02-07-2018

That sounds like a config precedence problem, because everything in etc/system/local will overwrite your settings. Check settings in etc/system/local/metadata . BTW, what happens if you do it the way I mentioned above and change it in etc/system/local instead a separate app? cheers, MuS

MuS · ‎01-29-2018

Welcome back @Ayn ! It's been a long time 😉 cheers, MuS PS: you should sign up for slack as well http://docs.splunk.com/Documentation/Community/1.0/community/Chat

MuS · ‎01-24-2018

Hi hsingams2, almost got it right 😉 Try this: | makeresults | eval user="johndoe" | eval foo="user" | eval foo2=user by using "" around the user you tell eval to use user as a string, and by not using "" around user you tell eval to refer to another field called user . Does that make sense? Hope this helps ... cheers, MuS

MuS · ‎01-23-2018

Thanks for uploading the screenshot again!

MuS · ‎01-23-2018

@elliotproebstel, sorry I accidentally deleted the screenshot while trying to make it show 😞

MuS · ‎01-23-2018

Hi pfabrizi, try this regex: Certificate was successfully validated\. serial number:\s+([0-9A-Z]+) You missed to escape the . . If it is still not working, check if there is no typo in the assigned sourcetype, source or hostname for the props stanza. Hope this helps ... cheers, MuS

MuS · ‎01-22-2018

@sh254087, sur you can; it is called conditional drill down and you can find more detail here http://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownIntro Take a look at this run everywhere example, and please note the extra option visible=1 which must be added otherwise uses could click on Apps that are not visible and encounter errors. <dashboard> <label>App drill down panel</label> <row> <panel> <table> <search> <query>| rest /services/apps/local | search disabled=0 core=0 visible=1 |dedup label | table label title</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <link target="_self">/app/$row.title$</link> </drilldown> </table> </panel> </row> </dashboard> cheers, MuS

MuS · ‎01-15-2018

Maybe this example http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath#Basic_examples or this http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath#Extended_examples is more suitable as example?

MuS · ‎12-19-2017

Nice finding! How about writing that up as new answer and accept it so it can help other finding the right solution? I suspect you were doing this on a Windows Splunk instance?

MuS · ‎12-14-2017

Look, I gave you an example how it can be done and you have the data available. All you need to do is adapt the search and try adding or removing fields before and after the stats to get the expected result. cheers, MuS

MuS · ‎12-14-2017

Just try: ( index=a host=system action=deleted ip=* ) OR ( index=b client_ip=* sender=* ) | fields userid, ip, action, sender, client_ip | eval correlation_field=case(isnotnull(ip), ip, isnotnull(client_ip), client_ip, 1=1, "unknown") | stats values(*) AS * by correlation_field cheers, MuS

MuS · ‎12-14-2017

... | eval correlation_field=case(isnotnull(ip), ip, isnotnull(client_ip), client_ip, 1=1, "unknown") | stats values(*) AS * by correlation_field cheers, MuS

MuS · ‎12-06-2017

As mentioned before, use another tool to do this like Chef, Puppet or .... even scp or rsync can do the job.

MuS · ‎12-04-2017

No I meant an actual file system check from the operating system.

MuS · ‎12-04-2017

That sounds like a bigger problem here .... also reading all you other questions. Random question: have you done a FS check lately on your Splunk server to see if everything is healthy?

MuS · ‎12-04-2017

Actually looking at the numbers are 1% CPU and 8% memory usage really that high? Does vmstat provide some hints where the potential bottleneck could be?

Posts	4458
Solutions	814
Karma Given	2144
Karma Received	3944
Member Since	‎05-02-2011

Online Status	Offline
Date Last Visited	Wednesday

Report Capture app for Splunk: Exception capturing...

How to use eval if there is no result from the bas...

How to compare fields over multiple sourcetypes wi...

Splunkbase Apps update bug?

docs.splunk.com wrong link to answers

splunkbase feature request

splunkbase colored background

Captain Picard's Star fleet messages

the pony command

max throughputs of forwarders

Re: Architect Certification lab

Re: How to join 2 query from different sources?

Re: How to join 2 query from different sources?

Re: How to join 2 query from different sources?

Re: How to join 2 query from different sources?

Re: Indexes.conf

Re: Indexes.conf

Re: Where is actually SPLUNK_DB located?

Re: How to CONTINOUSLY monitor logs on HTTP url

Re: Is there any way to restrict users/roles from ...

Re: Duration of a single event

Re: Evaluating dynamically generated field name

Re: search with joins and append takes too long

Re: search with joins and append takes too long

Re: Extract in Props.conf

Re: How to search a list of all enabled apps in Sp...

Re: how to split the json array into multiple new ...

Re: How can I get my TCP data into the metrics ind...

Re: How to write a search to correlate data from m...

Re: How to write a search to correlate data from m...

Re: How to write a search to correlate data from m...

Re: Using Splunk deployment server to deploy apps ...

Re: How to resolve timestamp and line processing i...

Re: How to resolve timestamp and line processing i...

Re: Why does an AIX 6.5.2 forwarder have high swap...

Join the Conversation